Your conditions don't allow to remove a blocking code, as it will always be put in place following the logic you defined. If you want to allow its removal, add a prerequisite of, say, user name. So, that this use will be able to remove the flag. In your rules it will look as "AND SYST-UNAME <> 'XXXXX'".